cell-survey

A passive cellular downlink band survey for a cheap RTL-SDR. It sweeps the US low-band cellular ranges and reports where the towers are transmitting: which bands are live, how strong, and how busy the air is.

It measures broadcast RF power only. It decodes nothing, it never transmits, and it captures no content. This is receive-only reconnaissance of signals that are already in the open.

What it shows

For each band (600 / 700 / 850 MHz) it prints whether the band is active, the strongest frequency and its level, the top channels, and an occupancy percentage.

600 MHz - Band 71          ACTIVE  peak 635.3 MHz @ 0.9 dB, 56% occupied
700 MHz - Bands 12/13/17   ACTIVE  peak 730.2 MHz @ 2.3 dB, 15% occupied
850 MHz - Band 5           ACTIVE  peak 881.1 MHz @ -9.7 dB, 29% occupied

Requirements

• An RTL-SDR (this was built on an RTL-SDR Blog V3, ~$30) with an antenna.
• rtl_power from the rtl-sdr / librtlsdr tools on your PATH.
• Python 3. No third-party Python packages.

Run

python3 survey.py

Writes cellular.json and prints a per-band summary.

What this is NOT

• Not an interceptor. Cellular traffic is encrypted end to end; this reads none of it.
• Not a stingray / IMSI catcher. Those transmit and impersonate a tower. This only receives.
• Not a cracker. There is no key in the air to recover.

Reception limits: the RTL-SDR tops out around 1.7 GHz, so mid-band and 5G are out of range. Receiving broadcast RF is generally legal; decoding others' traffic is not, and this tool does neither.

Built by @kernel.panic.0x11.